Package rekall :: Package plugins :: Package response :: Module files :: Class IRGlob
[frames] | no frames]

Class IRGlob

source code


Search for files by filename glob.

This code roughly based on the Glob flow in GRR.

Nested Classes
  __metaclass__
Automatic Plugin Registration through metaclasses. (Inherited from rekall.plugin.Command)
  top_level_class
A command can be run from the rekall command line. (Inherited from rekall.plugin.Command)
Instance Methods
 
column_types(self)
Returns instances for each column definition.
source code
 
__init__(self, *args, **kwargs)
x.__init__(...) initializes x; see help(type(x)) for signature
source code
 
convert_glob_into_path_components(self, pattern)
Converts a glob pattern into a list of pathspec components.
source code
 
make_component_tree(self, globs) source code
 
collect_globs(self, globs) source code
 
collect(self)
Collect data that will be passed to renderer.table_row.
source code
 
__iter__(self)
Make plugins that define collect iterable, as convenience. (Inherited from rekall.plugin.Command)
source code
 
__repr__(self)
repr(x) (Inherited from rekall.plugin.Command)
source code
 
__str__(self)
Render into a string using the text renderer. (Inherited from rekall.plugin.Command)
source code
 
collect_as_dicts(self) (Inherited from rekall.plugin.TypedProfileCommand) source code
 
get_column(self, name) (Inherited from rekall.plugin.TypedProfileCommand) source code
 
get_column_type(self, name) (Inherited from rekall.plugin.TypedProfileCommand) source code
 
get_plugin(self, name, **kwargs)
Returns an instance of the named plugin. (Inherited from rekall.plugin.Command)
source code
 
getkeys(self) (Inherited from rekall.plugin.TypedProfileCommand) source code
 
reflect(self, member) (Inherited from rekall.plugin.TypedProfileCommand) source code
 
render(self, renderer, **options) (Inherited from rekall.plugin.TypedProfileCommand) source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __setattr__, __sizeof__, __subclasshook__

Class Methods
 
GetActiveClasses(cls, session)
Return only the active commands based on config. (Inherited from rekall.plugin.Command)
source code
 
GetPrototype(cls, session)
Return an instance of this plugin with suitable default arguments. (Inherited from rekall.plugin.Command)
source code
 
ImplementationByClass(self, name) source code
 
ImplementationByName(self, name) source code
 
args(cls, parser) (Inherited from rekall.plugin.TypedProfileCommand) source code
 
is_active(cls, session)
Checks we are active. (Inherited from rekall.plugin.ProfileCommand)
source code
Class Variables
  name = 'glob'
  table_header = [{'name': 'path', 'type': 'FileInformation'}]
hash(x)
  INTERPOLATED_REGEX = re.compile(r'%%([^%]+?)%%')
  GROUPING_PATTERN = re.compile(r'(\{([^\}]+,[^\}]+)\}|%%([^%]+?...
  RECURSION_REGEX = re.compile(r'\*\*(\d*)')
  GLOB_MAGIC_CHECK = re.compile(r'[\*\?\[]')
  PROFILE_REQUIRED = False (Inherited from rekall.plugins.response.common.AbstractIRCommandPlugin)
  ROW_OPTIONS = set(['annotation', 'depth', 'hex_width', 'highli... (Inherited from rekall.plugin.TypedProfileCommand)
  classes = {'AFF4Acquire': <class 'rekall.plugins.tools.aff4acq... (Inherited from rekall.plugin.Command)
  classes_by_name = {None: [<class 'rekall.plugins.tools.ipython... (Inherited from rekall.plugin.Command)
  error_status = None
hash(x) (Inherited from rekall.plugin.Command)
  interactive = False (Inherited from rekall.plugin.Command)
  mode = 'mode_live'
hash(x) (Inherited from rekall.plugins.response.common.AbstractIRCommandPlugin)
  plugin_args = None
hash(x) (Inherited from rekall.plugin.ArgsParserMixin)
  plugin_feature = 'Command' (Inherited from rekall.plugin.Command)
  producer = False (Inherited from rekall.plugin.Command)
  table_options = {} (Inherited from rekall.plugin.TypedProfileCommand)
Properties

Inherited from object: __class__

Method Details

column_types(self)

source code 

Returns instances for each column definition.

The actual objects that are returned when the plugin runs are often determined at run time because they depend on the profile loaded.

This method is used in order to introspect the types of each column without actually running the plugin. A plugin must provide an instance for each column without running any code. This allows interospectors to learn about the output format before running the actual plugin.

Note that this method should almost always be overloaded. We try to do our best here but it is not ideal. Ultimately all plugins will override this method and just declare a column_types() method.

Overrides: plugin.TypedProfileCommand.column_types
(inherited documentation)

__init__(self, *args, **kwargs)
(Constructor)

source code 

x.__init__(...) initializes x; see help(type(x)) for signature

Overrides: object.__init__
(inherited documentation)

convert_glob_into_path_components(self, pattern)

source code 
Converts a glob pattern into a list of pathspec components.

Wildcards are also converted to regular expressions. The pathspec
components do not span directories, and are marked as a regex or a
literal component.

We also support recursion into directories using the ** notation.  For
example, /home/**2/foo.txt will find all files named foo.txt recursed 2
directories deep. If the directory depth is omitted, it defaults to 3.

Example:
 /home/test**/*exe -> [{path: 'home', type: "LITERAL",
                       {path: 'test.*\Z(?ms)', type: "RECURSIVE",
                       {path: '.*exe\Z(?ms)', type="REGEX"}]]

Args:
  pattern: A glob expression with wildcards.

Returns:
  A list of PathSpec instances for each component.

Raises:
  ValueError: If the glob is invalid.

collect(self)

source code 

Collect data that will be passed to renderer.table_row.

Overrides: plugin.TypedProfileCommand.collect
(inherited documentation)

ImplementationByClass(self, name)
Class Method

source code 
Overrides: plugin.Command.ImplementationByClass

ImplementationByName(self, name)
Class Method

source code 
Overrides: plugin.Command.ImplementationByName

Class Variable Details

GROUPING_PATTERN

Value:
re.compile(r'(\{([^\}]+,[^\}]+)\}|%%([^%]+?)%%)')